Questions tagged [lets-encrypt]

Let's Encrypt is a certificate authority that provides free X.509 certificates for TLS encryption.

Filter by
Sorted by
Tagged with
242 votes
11 answers
556k views

How to use Let's Encrypt DNS-01 challenge validation?

Let's Encrypt has announced they have: Turned on support for the ACME DNS challenge How do I make ./letsencrypt-auto generate a new certificate using DNS challenge domain validation? EDIT I mean: ...
Pierre Prinetti's user avatar
163 votes
12 answers
332k views

Best practices for setting a cron job for Let's Encrypt (Certbot) renewal?

Is this correct way to set cron for renewal of Let's Encrypt cert in Apache2 ? I use Ubuntu 16.04. @monthly letsencrypt renew && service apache2 reload
user3448600's user avatar
  • 1,629
57 votes
2 answers
85k views

Lets Encrypt with an nginx reverse proxy

Introduction I have a dev server (currently running Ubuntu 14.04 LTS), which I have been using for a while now for hosting various development tools on different ports. Because the ports can be hard ...
0x450's user avatar
  • 673
40 votes
5 answers
79k views

SSL & Ngnix: no "ssl_certificate" is defined in server listening on SSL port while SSL handshaking

I have managed to create my certificates with LE with not errors, I have also managed to redirect my traffic from port 80 to port 443. But when i reload my nginx server I am unable to access my ...
0xtuytuy's user avatar
  • 523
35 votes
5 answers
46k views

how do I change the admin email for let's encrypt?

The email address used as the admin email when we started using let's encrypt needs to be modified (a former employee used his personal email address as the admin email and he is no longer with the ...
ali haider's user avatar
  • 1,170
35 votes
5 answers
62k views

Nginx disable .htaccess and hidden files but allow .well-known directory

I have a Nginx server, and disabled hidden files in the nginx_vhost.conf ## Disable .htaccess and other hidden files location ~ /\. { deny all; access_log off; ...
Janghou's user avatar
  • 505
26 votes
4 answers
87k views

Certbot letsencrypt on different port than 443

I want to set up certbot for a webserver on a different port than 443. I got the following error when running certbot --apache -d <sub>.<domain>.<ext> Failed authorization ...
CaptainJack's user avatar
23 votes
6 answers
23k views

Client on Debian 9 erroneously reports expired certificate for letsencrypt-issued domain

If I try to access our HTTPS server that has certbot-issued certificate from debian 9, I get the following error: # curl -v https://hu.dbpedia.org/ * Trying 195.111.2.82... * TCP_NODELAY set * ...
P.Péter's user avatar
  • 639
21 votes
2 answers
5k views

How can Let's Encrypt verify the identity over insecure http?

I just started using Let's Encrypt. The http-01-challenge is simple enough: Make a webserver respond to http://example.com Ask Let's Encrypt for a challenge-file Provide the file unter http://example....
Andreas's user avatar
  • 393
19 votes
4 answers
77k views

Nginx SSL_do_handshake() failed SSL: error:1417D18C:SSL

Today we've installed a SSL certificate (from letsencrypt) on our server which hosts a very busy website. After a few hours we've noticed that we have some users are getting errors from nginx: 2018/...
user1518820's user avatar
19 votes
2 answers
12k views

Redirect all requests to HTTPS, except for one subdirectory

I'm trying to move from self-signed certificates to Let's Encrypt certificates on my nginx webserver. Currently, I redirect all requests to http/80 to https/443, which uses a self signed certificate ...
SaAtomic's user avatar
  • 339
17 votes
1 answer
12k views

How to setup coturn with letsencrypt

Giving this setup: A Nginx is providing a .well-known folder listening on port 80/443 on the server to exchange the chellange for Letsencrypt. The certificate is created properly and can be used e.g. ...
frlan's user avatar
  • 573
17 votes
2 answers
4k views

Why not validate self signed certificates through DNS-record instead of letsencrypt

I was just wondering. We use a lot of SSL certificates. Nowadays, we almost exclusively use letsencrypt (thanks!). The bottom line of these certificates is, that proof of ownership of the domain name(...
Jelmer Jellema's user avatar
17 votes
1 answer
10k views

Let's Encrypt certbot validation over HTTPS

Update: The original SNI challenge type has been disabled. There is a new more secure SNI challenge type with limited server support. SNI is not likely a suitable option for small sites. I have ...
Daniel F's user avatar
  • 373
16 votes
5 answers
27k views

Let's Encrypt SSL Certificate File Not Found Error, but still working

I'm running SSL Certificates from Let's Encrypt. I've got them installed on my Ubuntu machine running Apache. The setup works fine and I can launch the website, see the green padlock and even got an A+...
jarvis's user avatar
  • 2,006
16 votes
1 answer
78k views

Renew domains using certbot and using DNS challenge

I created several SSL certificates for several domains using the standalone method. I am only interested in the certificates, without server integration. They are now for renewal. So, I ran: certbot ...
Merc's user avatar
  • 807
14 votes
1 answer
4k views

Why does my Let's Encrypt certificate contain references to Cloudflare?

I own a website that uses a Let's Encrypt certificate. It's not behind Cloudflare, it's hosted at OVH and I'm accepting direct traffic from it. Now, I set up an apache2 webserver and used certbot to ...
lolc's user avatar
  • 153
11 votes
3 answers
18k views

Does order of lines matter in Nginx?

I have a server file like this server { listen 80; server_name subdomain.example.com; return 301 https://$server_name$request_uri; location /.well-known/acme-challenge { root /var/www/...
Saras Arya's user avatar
10 votes
1 answer
5k views

A+ rating still unsecure by Google Chrome's opinion

I am provisioning my server on DigitalOcean, and although I am getting an A+ rating from ssllabs, https://www.ssllabs.com/ssltest/analyze.html?d=zandu.biz when I connect to my site, https://www....
The Architect's user avatar
10 votes
3 answers
10k views

Let's encrypt: Remove only one hostname from certificate

I have the following certificate: # certbot certificates Saving debug log to /var/log/letsencrypt/letsencrypt.log Found the following certs: Certificate Name: domain.example Domains: domain....
manifestor's user avatar
  • 6,399
10 votes
1 answer
2k views

Do SSL Certs containing two wildcards work (esp. on Let's Encrypt)? [duplicate]

I want to include two wildcards in an SSL cert (will be) signed by Let's Encrypt: *.*.thost3.de. Will this cert match any hostnames matching that rule (e.g. example.example.thost3.de, hello.world....
Emoji's user avatar
  • 201
10 votes
1 answer
10k views

Trying to get 100% in ssllabs.com key exchange

I wanted to know what steps are needed to get 100% on every category in ssllabs.com. I am aware that this could lead to problems in older systems, but I dont care. My letsencrypt.org certificate ...
feedc0de's user avatar
  • 269
10 votes
1 answer
8k views

RabbitMQ with a LetsEncrypt certificate

I have been trying to install my LetsEncrypt generated certificates into my rabbitmq server but have had no luck. To test things out with out having to fight permission issues I have copied the pem ...
Brian Cain's user avatar
9 votes
3 answers
34k views

How can I get a Let's Encrypt certificate for a non-public facing server?

I have a private Apache server, reachable only from my LAN on port 443, with a StartSSL certificate. Since Firefox 51 was released, I cannot connect to it any longer as the StartSSL root certificate ...
Calimo's user avatar
  • 410
9 votes
3 answers
53k views

How do I specify a port other than 80 when adding SSL certificate using Certbot?

I have a server which runs 2 different web servers (Apache and Nginx). The Apache server takes care of all the traffic directed to Wordpress sites whereas the Nginx server serves my Python API and ...
Dimitar Veljanovski's user avatar
8 votes
10 answers
23k views

Using Lets Encrypt certificates with openLDAP

I've been running an openLDAP server for several months now and we use it to authenticate for a number of applications. A previous staff member set up the server and it doesn't seem to be a standard ...
shaneoh's user avatar
  • 424
8 votes
4 answers
15k views

Lets Encrypt OpenVPN AS

I've got an OpenVPN AS running and I am trying to setup SSL certs (running ubuntu) from letsencrypt. I've managed to get my certificates from letsencrypt (using letsencrypt standalone) and I was ...
Ben Flowers's user avatar
8 votes
2 answers
20k views

nginx "ERR_TOO_MANY_REDIRECTS" after add ssl

After i add Let's Encrypt certificate to my website with CertBot i get ERR_TOO_MANY_REDIRECTS when i try to visit the domain of my website. some info : -mywebsite build with django, nginx and ...
DAMAR225's user avatar
  • 183
8 votes
3 answers
16k views

NGINX redirect everything except letsencrypt to https

I have a simple config, redirect everything except letsencrypt requests to https, and then have my virtual hosts only on https.. Currently all my requests are redirected to https, and then a 404 for ...
Richard87's user avatar
  • 250
8 votes
2 answers
3k views

Wildcard SSL with LetsEncrypt gives error

I want to create wildcard SSL for my website via LetsEncrypt. I followed the instruction and after running Certbot, it gives me a DNS challenge and says: Please deploy a DNS TXT record under the name ...
Fcoder's user avatar
  • 351
8 votes
2 answers
2k views

Letsencrypt - do I need to keep ".well-known" accessible for certificate renewal?

I created a certificate for my Apache 2.4 server. To validate my server letsencrypt created the folder .well-known and accessed it. Do I need to keep this folder accessible (for certificate renewal) ...
dermoritz's user avatar
  • 181
8 votes
1 answer
1k views

Use LetsEncrypt certs with Neo4j

How can one use the certificate files generated by LetsEncrypt together with a Neo4j instance? The files generated by LetsEncrypt are: cert.pem chain.pem fullchain.pem privkey.pem I've tried ...
Michael Johansen's user avatar
8 votes
1 answer
9k views

Redirect everything but .well-known in NGINX (Let's Encrypt)

I want to get a certificate via the letsencrypt.sh so I have to provide a challenge on HTTP. Already I use NGINX to forward to SSL (served on a nodejs server). Now I want to still redirect everything ...
Alex's user avatar
  • 726
8 votes
2 answers
3k views

Using Let's Encrypt inside Docker's official Wordpress container

I'm trying to get Let's Encrypt inside the official Docker Wordpress container. Setup the environment $ cat docker-compose.yml wordpress: hostname: some.fqdn.com image: wordpress links: - ...
vpetersson's user avatar
8 votes
1 answer
1k views

Utilizing SSL on Multi-domain, Autoscaling Elastic Beanstalk Setup

We are creating a Content Management System for our company. It is important that this CMS support dynamic domain names on a dynamic number of servers. After many hours of research we felt that Amazon'...
Patrick Stephan's user avatar
7 votes
1 answer
25k views

Letsencrypt for all subdomains *.example.com [duplicate]

I'd like to obtain one certificate working for all my subdomains *.example.com. This works: certbot-auto certonly --webroot --webroot-path /home/www/example/ --domain example.com ...
Basj's user avatar
  • 739
7 votes
1 answer
1k views

Explain Certbot's HTTPS redirect configuration

Can someone explain why Certbot is using the following redirect configuration server { if ($host = example.com) { return 301 https://$host$request_uri; } # managed by Certbot ...
Daniel's user avatar
  • 7,049
7 votes
5 answers
3k views

How do I conditionally set the SSLCertificateFile when the file exists?

I am using Let's Encrypt (certonly) to generate SSL certificates for several websites hosted on an Apache server. The file location of these certificates is determinate before they are created, so I ...
Nathan's user avatar
  • 223
7 votes
1 answer
14k views

Renew letsencrypt certificate on Apache httpd

I'm using certbot --webroot plugin and certbot renew to renew the certificate, which does work, but it looks like httpd is caching the certificate and does not "see" that it's been updated. Is there ...
rustyx's user avatar
  • 1,757
7 votes
3 answers
4k views

configure CouchDB with Lets Encrypt SSL certificate

What i would like to do: Now I'm using a self signed SSL certificate which works wonderful. But I would like to replace them with an official one of lets encrypt. What i have (self signed certificate)...
mnewmedia's user avatar
  • 171
7 votes
1 answer
7k views

How to have apache handle .well-known/acme-challenge and still have / passed to wsgi

In order to support automatic LetsEncrypt certificate renewal certbot uses the --apache handler. e.g. certbot renew --apache This handler installs a temporary VirtualHost for */.well-known/acme-...
Jay M's user avatar
  • 398
7 votes
1 answer
7k views

nginx https www redirect to non-www using let's encrypt certbot

Hi this must be a basic question but I haven't seen an answer with cerbot considerations (if there are any considerations). How do I get https www to redirect to non-www instead of timing out? The ...
duncangarde's user avatar
7 votes
1 answer
16k views

Adding a subdomain on Google Domains

I'm trying to create a TXT DNS record with name _acme-challenge.www on Google Domains to allow me to validate my DNS (i.e. via _acme-challenge.www.example.com). I've already validated the domain ...
JohnLBevan's user avatar
  • 1,312
7 votes
3 answers
8k views

Let's Encrypt -- "DNS ... query timed out looking up CAA for ..."

I have been using Let's Encrypt on a few domains for a couple of months now, and it generally has been working. I was going through renewing the certs, and for one of the domains I get the following ...
Michael's user avatar
  • 231
6 votes
3 answers
18k views

How to grant access to "/.well-known" directory on SVN server (Apache 2.2)

I cannot figure out how to disable authentication for the .well-known directory. Things behave as expected when I remove the SVN specific directives (DAV, SVNPath, AuthzSVNAccessFile). <...
Reto Höhener's user avatar
6 votes
1 answer
2k views

Why does certbot suddenly fall back to http-01 challenge instead of tls-sni-01 (https)?

I have a well-tested bash script that was running fine until a few weeks ago. It seems that certbot challenge defaults now to http instead of https. I can't figure out the reason. echo 'rsa-key-size =...
Houman's user avatar
  • 1,675
6 votes
2 answers
5k views

Use Letsencrypt certificates for Postgresql

I have successfully configured Letsencrypt for my NGINX webserver on Debian 8 Jessie. Now I have installed Postgresql 9.4 and want to use the LE certificates (in /etc/letsencrypt/live/mydomain/com/......
algielen's user avatar
6 votes
1 answer
2k views

SSL alert number 113

We're seeing some errors in the past few days similar to this one, in our nginx error logs: /var/log/nginx/error.log.2.gz:2017/01/30 16:11:46 [crit] 13114#13114: *139338 SSL_do_handshake() failed (SSL:...
Simon Woodside's user avatar
6 votes
0 answers
11k views

SSL_do_handshake() failed (SSL: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share) while SSL handshaking, client:

A few months ago I started getting complaints from dozens of users about getting errors when connecting to my site. When I look into the error.log of nginx I see daily SSL errors: I have no idea what ...
Michiel's user avatar
  • 61
6 votes
0 answers
893 views

Error creating Letsencrypt certificate from Azure web site extension

Our web app running on Azure has the Azure Let's Encrypt 0.9.6 extension installed. Launching the extension (https://********-website-stage.scm.azurewebsites.net/letsencrypt/) is no problem and we get ...
GordonLiddy's user avatar

1
2 3 4 5
17